Need HIPAA compliant forms? Intake that lands in the client record, under a BAA.

The basics

What makes an intake form HIPAA compliant?

A form is only as safe as the system behind it. If you're a covered entity, every vendor that collects, stores or sends your patients' answers needs a signed BAA (HHS). Then check four things:

1. Encryption. Answers encrypted in transit when submitted and at rest once stored.
2. Where answers go. Into a secure record, not an email inbox, a spreadsheet export or a shared drive.
3. Who can see them. Only staff who need them for that client.
4. Minimum necessary. Ask only for what you'll use. Every extra field is more PHI to protect.

Your side still matters: your risk analysis, privacy notice and staff training. No form builder makes a practice compliant on its own. Nothing here is legal advice; check your setup with your compliance advisor.

Is a HIPAA compliant form builder enough?

Often not. A standalone form builder with a BAA protects the form. But if staff then download the answers, email a PDF or retype them into a CRM without a BAA, the PHI leaves the safe zone. Digital intake forms work best when the form, the client record and the schedule are covered by the same BAA. When you compare form builders, check which plan includes the BAA and where submissions end up. Our BAA comparison of 18 vendors covers the CRM and scheduling side.

Field checklist

The fields a HIPAA-aware intake form needs

Use this as a starting list and remove anything you won't use. Clinical history beyond what your service requires belongs in your EHR, not your intake form.

How it works

QR code intake, from front desk to client record

1. Build the form in the form builder, using the field checklist above.
2. Print its QR code for the front desk, or share the form link before the visit.
3. The client scans and fills it in on their own phone.
4. The answers are saved with that client's profile, next to the appointment.
5. Staff with access review it before the visit. Nobody retypes anything.

Never collect intake by WhatsApp, text or email attachment. The JBMOnboard360 WhatsApp concierge is for general enquiries like prices, hours and booking a callback, never for health information.

When JBMOnboard360 is not the right fit

• You need e-signatures on legal consent forms. Ask us in the consultation what your consent workflow needs before relying on the form builder for it.
• You need intake to flow into an EHR. We don't claim EHR integrations. JBMOnboard360 is not an EHR or clinical documentation system; keep your clinical system for charting.
• You only need one form and nothing else. A standalone form builder with a BAA may be cheaper. JBMOnboard360 pays off when you also want the CRM, scheduling, invoicing and help desk.